@heossi/qnsi 0.5.1 → 0.5.4

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @heossi/qnsi
 
+## 0.5.3
+
+### Patch Changes
+
+- d9ab7af: Bump `@noble/post-quantum` 0.6.0 → 0.6.1 (the SDK's pure-JS / cross-verification PQC provider).
+
+  Cryptographically equivalent to 0.6.0: the regenerated NIST ACVP determinism vectors confirm keygen output is byte-identical (every ML-KEM / ML-DSA / SLH-DSA key SHA-256 matched the 0.6.0 values), and the published conformance run is unchanged (noble 435/435 against the official NIST ACVP test vectors). No API or behavior change — the dependency floor moves to the latest patch.
+
 ## 0.3.0
 
 ### Minor Changes

package/README.md

@@ -5,7 +5,7 @@
 
 The official **single-package** Node.js / TypeScript SDK for QNSI. Covers the full customer-facing platform — vault, KMS, audit, auth, tenant, access-control, billing, crypto-inventory, storage, search, and AI orchestrator — plus webhook signature verification. Mirrors the shape of the `qnsi` Python / Go / Rust SDKs byte-for-byte: same wire contracts, same algorithm names, same FIPS 203 / 204 / 205 posture.
 
-> **Free tier available.** Free-forever account at <https://cloud.qnsi.heossi.com/auth> — 60-second signup, no credit card. Includes 10 GB PQC storage, 50 000 API calls/month, 20 KMS keys, 25 vault secrets.
+> **Platform:** <https://qnsi.heossi.com> · **Free tier:** free-forever account at <https://cloud.qnsi.heossi.com/auth> — 60-second signup, no credit card. Includes 10 GB PQC storage, 50 000 API calls/month, 20 KMS keys, 25 vault secrets.
 
 ## Why one package?
 

package/dist/vault.d.ts

@@ -13,7 +13,26 @@ export declare class VaultClient {
     private readonly internal;
     constructor(internal: Internal);
     createSecret(req: CreateSecretRequest, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Record<string, unknown>>;
+    /** Secret metadata + the ML-KEM-wrapped envelope (NOT the plaintext). */
     getSecret(secretId: string): Promise<Record<string, unknown>>;
+    /**
+     * The DECRYPTED plaintext of a secret: `{ value }`. Server-side unwrap of the
+     * ML-KEM-wrapped envelope, tenant-isolated by the API key.
+     */
+    getSecretValue(secretId: string): Promise<{
+        value: string;
+    }>;
+    /**
+     * List the tenant's secrets (metadata: id, name, versions — never the payload).
+     * The tenant is derived from the API key. Use to resolve a secret by name.
+     */
+    listSecrets(query?: RequestOptions["query"]): Promise<Record<string, unknown>>;
+    /**
+     * Resolve a secret by NAME to its decrypted plaintext string, or null if no
+     * secret with that name exists. The vault addresses secrets by id, so this
+     * lists (to map name→id) then fetches the decrypted value.
+     */
+    getSecretValueByName(name: string): Promise<string | null>;
     getSecretVersion(secretId: string, version: number): Promise<Record<string, unknown>>;
     rotateSecret(secretId: string, payloadB64: string, algorithm?: string, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Record<string, unknown>>;
     deleteSecret(secretId: string): Promise<Record<string, unknown>>;

package/dist/vault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAI/D,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED,qBAAa,WAAW;IACX,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,QAAQ;IAE/C,YAAY,CAAC,GAAG,EAAE,mBAAmB,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAYpF,SAAS,CAAC,QAAQ,EAAE,MAAM;IAI1B,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IAIlD,YAAY,CACX,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAS9C,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAIhE,kBAAkB,CAAC,QAAQ,EAAE,MAAM;CAGnC"}
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAI/D,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED,qBAAa,WAAW;IACX,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,QAAQ;IAE/C,YAAY,CAAC,GAAG,EAAE,mBAAmB,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAYpF,yEAAyE;IACzE,SAAS,CAAC,QAAQ,EAAE,MAAM;IAI1B;;;OAGG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAM5D;;;OAGG;IACH,WAAW,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC;IAI3C;;;;OAIG;IACG,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAShE,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IAIlD,YAAY,CACX,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAS9C,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAIhE,kBAAkB,CAAC,QAAQ,EAAE,MAAM;CAGnC"}

package/dist/vault.js

@@ -19,9 +19,38 @@ export class VaultClient {
         const body = { name: req.name, payload: req.payloadB64, metadata };
         return this.internal.request("POST", `${PATH_PREFIX}/secrets`, body, opts);
     }
+    /** Secret metadata + the ML-KEM-wrapped envelope (NOT the plaintext). */
     getSecret(secretId) {
         return this.internal.request("GET", `${PATH_PREFIX}/secrets/${secretId}`);
     }
+    /**
+     * The DECRYPTED plaintext of a secret: `{ value }`. Server-side unwrap of the
+     * ML-KEM-wrapped envelope, tenant-isolated by the API key.
+     */
+    getSecretValue(secretId) {
+        return this.internal.request("GET", `${PATH_PREFIX}/secrets/${secretId}/value`);
+    }
+    /**
+     * List the tenant's secrets (metadata: id, name, versions — never the payload).
+     * The tenant is derived from the API key. Use to resolve a secret by name.
+     */
+    listSecrets(query) {
+        return this.internal.request("GET", `${PATH_PREFIX}/secrets`, undefined, { query });
+    }
+    /**
+     * Resolve a secret by NAME to its decrypted plaintext string, or null if no
+     * secret with that name exists. The vault addresses secrets by id, so this
+     * lists (to map name→id) then fetches the decrypted value.
+     */
+    async getSecretValueByName(name) {
+        const listed = (await this.listSecrets());
+        const match = (listed?.secrets ?? []).find((s) => s["name"] === name);
+        const id = match?.["id"];
+        if (typeof id !== "string")
+            return null;
+        const { value } = await this.getSecretValue(id);
+        return value ?? null;
+    }
     getSecretVersion(secretId, version) {
         return this.internal.request("GET", `${PATH_PREFIX}/secrets/${secretId}/versions/${version}`);
     }

package/dist/vault.js.map

@@ -1 +1 @@
-{"version":3,"file":"vault.js","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAStC,MAAM,OAAO,WAAW;IACM;IAA7B,YAA6B,QAAkB;QAAlB,aAAQ,GAAR,QAAQ,CAAU;IAAG,CAAC;IAEnD,YAAY,CAAC,GAAwB,EAAE,IAA6C;QACnF,6EAA6E;QAC7E,8EAA8E;QAC9E,wEAAwE;QACxE,MAAM,QAAQ,GAAG;YAChB,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;YACvB,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;QACF,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED,SAAS,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,YAAY,QAAQ,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,gBAAgB,CAAC,QAAgB,EAAE,OAAe;QACjD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,YAAY,QAAQ,aAAa,OAAO,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,YAAY,CACX,QAAgB,EAChB,UAAkB,EAClB,SAAkB,EAClB,IAA6C;QAE7C,0EAA0E;QAC1E,4EAA4E;QAC5E,MAAM,IAAI,GAA4B,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;QACjE,IAAI,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,YAAY,QAAQ,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/F,CAAC;IAED,YAAY,CAAC,QAAgB;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,WAAW,YAAY,QAAQ,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,kBAAkB,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,YAAY,QAAQ,WAAW,CAAC,CAAC;IACpF,CAAC;CACD"}
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAStC,MAAM,OAAO,WAAW;IACM;IAA7B,YAA6B,QAAkB;QAAlB,aAAQ,GAAR,QAAQ,CAAU;IAAG,CAAC;IAEnD,YAAY,CAAC,GAAwB,EAAE,IAA6C;QACnF,6EAA6E;QAC7E,8EAA8E;QAC9E,wEAAwE;QACxE,MAAM,QAAQ,GAAG;YAChB,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;YACvB,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;QACF,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED,yEAAyE;IACzE,SAAS,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,YAAY,QAAQ,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED;;;OAGG;IACH,cAAc,CAAC,QAAgB;QAC9B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,YAAY,QAAQ,QAAQ,CAE5E,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,KAA+B;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,UAAU,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB,CAAC,IAAY;QACtC,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAiD,CAAC;QAC1F,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QACtE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,OAAO,EAAE,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QAChD,OAAO,KAAK,IAAI,IAAI,CAAC;IACtB,CAAC;IAED,gBAAgB,CAAC,QAAgB,EAAE,OAAe;QACjD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,YAAY,QAAQ,aAAa,OAAO,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,YAAY,CACX,QAAgB,EAChB,UAAkB,EAClB,SAAkB,EAClB,IAA6C;QAE7C,0EAA0E;QAC1E,4EAA4E;QAC5E,MAAM,IAAI,GAA4B,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;QACjE,IAAI,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,YAAY,QAAQ,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/F,CAAC;IAED,YAAY,CAAC,QAAgB;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,WAAW,YAAY,QAAQ,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,kBAAkB,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,YAAY,QAAQ,WAAW,CAAC,CAAC;IACpF,CAAC;CACD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heossi/qnsi",
-  "version": "0.5.1",
+  "version": "0.5.4",
   "publishConfig": {
     "access": "public"
   },
@@ -48,16 +48,12 @@
   },
   "peerDependencies": {
     "@langchain/core": ">=0.3.0",
-    "autogen": ">=0.0.1",
     "llamaindex": ">=0.5.0"
   },
   "peerDependenciesMeta": {
     "@langchain/core": {
       "optional": true
     },
-    "autogen": {
-      "optional": true
-    },
     "llamaindex": {
       "optional": true
     }
@@ -99,7 +95,7 @@
     "url": "https://github.com/heossihq/qnsi-public",
     "directory": "packages/qnsi"
   },
-  "homepage": "https://cloud.qnsi.heossi.com",
+  "homepage": "https://qnsi.heossi.com",
   "bugs": {
     "url": "https://github.com/heossihq/qnsi-public/issues"
   },